{"cve":"CVE-2026-89620","nvd":{"published":"2026-09-11T20:19:47.280","modified":"2026-10-19T09:17:58.767","status":"Received","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: intel-thc-hid: intel-quickspi: validate report size before copy\n\nwrite_cmd_to_txdma() builds an output report in qsdev->report_buf, a heap\nbuffer allocated in quickspi_alloc_report_buf() to the device-descriptor\nderived max_report_len (a few hundred bytes for a touch controller).  It\ncopies the caller-supplied report into that buffer:\n\n    memcpy(write_buf->content, report_buf, report_buf_len);\n\nThe HID core caps a report at HID_MAX_BUFFER_SIZE (16384) by default, and\nquickspi_hid_ll_driver does not set max_buffer_size, so the length reaches\nthe driver unbounded.  A hidraw SET_REPORT/SET_FEATURE ioctl carrying a\nreport larger than max_report_len therefore overflows report_buf with\nattacker-controlled length and content.\n\nRecord the report_buf allocation size and reject reports that do not fit\nbefore copying, matching the equivalent guard in the intel-quicki2c\nsibling (quicki2c_init_write_buf()) and the hid-goodix-spi fix.\n\nwrite_cmd_to_txdma() writes the output report header ahead of the content\nin the same buffer, so size the allocation to cover the header as well.\nThat keeps the added bound from rejecting a maximum-sized report.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8},"cwes":[],"references":["https://git.kernel.org/stable/c/6fcefe71aeb524f6e77fe586fe85d873745e917c","https://git.kernel.org/stable/c/a59cf84441f9a17323c89452cec2bf16724c48a9","https://git.kernel.org/stable/c/ee8ad1bb1e96164d51089b1182f1bd5f187e7baa"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:53:43.293028046+00:00"},"epss":{"cve":"CVE-2026-89620","score":0.00173,"percentile":0.06729,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}